MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c91fdcc94d5c660d185a1a8ea3df8d362158357d4ce3c439ea025bd78e8b23f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c91fdcc94d5c660d185a1a8ea3df8d362158357d4ce3c439ea025bd78e8b23f
SHA3-384 hash: 6cf8197524e6bcb9e93e8345f99a8555f33144f2e9123ffa10ac9e4ddb6afa52b4bec8c872502c16ad457922d0bb6be2
SHA1 hash: bc36fd29d93c14b555d0492c618d5f594aa11df1
MD5 hash: fbc4bfc223d278ad0b8f1f4e087a570a
humanhash: bulldog-october-single-robin
File name:Invoice no.9673.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'227'776 bytes
First seen:2024-11-28 08:05:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:Jtb20pkaCqT5TBWgNQ7aZ3CWs0vPd2ew37H6A:aVg5tQ7aZSWpvF2eW5
TLSH T11245C01373DD8361C3B25273BA65B701BE7F782506A5F96B2FD8093DE920122521EA73
TrID 68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.5% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
File icon (PE):PE icon
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter cocaman
Tags:exe FormBook INVOICE

Intelligence

File Origin
# of uploads :
1
# of downloads :
402
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Invoice no.9673.exe
Verdict:
No threats detected
Analysis date:
2024-11-28 08:08:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f8cf1e09-a067-43ff-9175-b951ba25ab1b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=674825aad0583382434ba4cc
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit compiled-script evasive fingerprint keylogger lolbin masquerade microsoft_visual_cc packed packed packer_detected redcap regedit
Link:
https://www.filescan.io/uploads/674824758d3140be444240d7/reports/5cb0b49e-98a8-49f2-98d5-06b75dbe9d9a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/5c91fdcc94d5c660d185a1a8ea3df8d362158357d4ce3c439ea025bd78e8b23f
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d2295b4e-9bb3-4175-a247-db8035e945f0
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1564372
Signature
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5c91fdcc94d5c660d185a1a8ea3df8d362158357d4ce3c439ea025bd78e8b23f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c91fdcc94d5c660d185a1a8ea3df8d362158357d4ce3c439ea025bd78e8b23f/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2024-11-28 01:10:51 UTC
File Type:
PE (Exe)
Extracted files:
27
AV detection:
29 of 38 (76.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lsi73teu2xdgbumfuguouppy2nrbla2x2thdyq46uas326hiwi7q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
unknown_loader_036
Create hunting rule
autoit
Create hunting rule
Similar samples:
error
Formbook
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/241128-jzd47sxlcm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/76f7467a-51eb-48b2-a281-d08d8f0a6b9f
Unpacked files
SH256 hash:
3356c68a07332bc673a401d0344b916064090ccd447377d9335f42f34262b458
MD5 hash:
1c828bf0048602596d820514936d947e
SHA1 hash:
f3b0d2b360e467475b08e86393f2d89b63a7cf59
Link:
https://www.unpac.me/results/87aede58-3b8e-4121-92f0-80730e3a413e/
Parent samples :
78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf
693424f033f85a79af47963f829e65b5315faad47cd4a82d3a0a76c6962c9968
66414ea66a2dc1d4bc840e98b4b7f22d78826e39370fdb44c62260dc1d048a8f
0cf59270641cc6e7790ae47a708f1e4e2fa9735d1743dc507b2e733fe9b7cfb4
SH256 hash:
34729ecfa93d2fa712b217df79618e82170cd359155752013dcd73c006c37b87
MD5 hash:
db2e04af69eff7d66698317c7a37dfc5
SHA1 hash:
99a4fbae56fe197c3631fd7f05d5b1b8872fb84f
Link:
https://www.unpac.me/results/87aede58-3b8e-4121-92f0-80730e3a413e/
SH256 hash:
5c91fdcc94d5c660d185a1a8ea3df8d362158357d4ce3c439ea025bd78e8b23f
MD5 hash:
fbc4bfc223d278ad0b8f1f4e087a570a
SHA1 hash:
bc36fd29d93c14b555d0492c618d5f594aa11df1
Link:
https://www.unpac.me/results/87aede58-3b8e-4121-92f0-80730e3a413e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5c91fdcc94d5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 772c2e186f85d316aab180b3f3b8ecc1eb69e2c4181df58d9e639a14da7e0d51

Formbook

Executable exe 5c91fdcc94d5c660d185a1a8ea3df8d362158357d4ce3c439ea025bd78e8b23f

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 772c2e186f85d316aab180b3f3b8ecc1eb69e2c4181df58d9e639a14da7e0d51
  
Dropped by
MD5 f575ed3a30393592f2f2a4dcd0d7dafa

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::CopySid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::GetAce
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
IPHLPAPI.DLL::IcmpCreateFile
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments